Get-AzADUser 在 Azure Devops MS 托管代理上返回空

Question

I am using Az Powershell Module on Azure Devops Pipeline Task. My problem is that Get-AzADUser command returns empty on Azure Devops MS hosted agent although it functions well on Azure Cloud Shell and returns the AzAD Users . I am using the same account for both (Cloud Shell and Azure Devops).

Here below are the logs of the Azure Devops Task:

2020-10-23T09:04:34.5200816Z ##[section]Starting: Azure PowerShell script: FilePath
2020-10-23T09:04:34.5561322Z ==============================================================================
2020-10-23T09:04:34.5562144Z Task         : Azure PowerShell
2020-10-23T09:04:34.5563006Z Description  : Run a PowerShell script within an Azure environment
2020-10-23T09:04:34.5563312Z Version      : 5.176.2
2020-10-23T09:04:34.5564072Z Author       : Microsoft Corporation
2020-10-23T09:04:34.5565422Z Help         : https://aka.ms/azurepowershelltroubleshooting
2020-10-23T09:04:34.5566084Z ==============================================================================
2020-10-23T09:04:36.0669385Z Generating script.
2020-10-23T09:04:36.1560120Z ========================== Starting Command Output ===========================
2020-10-23T09:04:36.1824475Z ##[command]"C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -Command ". 'D:\a\_temp\11730398-1e70-4056-a1ec-5d9694307da4.ps1'"
2020-10-23T09:04:39.1363993Z ##[command]Import-Module -Name C:\Modules\az_4.7.0\Az.Accounts\1.9.4\Az.Accounts.psd1 -Global
2020-10-23T09:04:48.4455502Z ##[command]Clear-AzContext -Scope Process
2020-10-23T09:04:49.5325261Z ##[command]Clear-AzContext -Scope CurrentUser -Force -ErrorAction SilentlyContinue
2020-10-23T09:04:49.8445719Z ##[command]Connect-AzAccount -ServicePrincipal -Tenant *** -Credential System.Management.Automation.PSCredential -Environment AzureCloud @processScope
2020-10-23T09:04:52.0059255Z ##[command] Set-AzContext -SubscriptionId *** -TenantId ***
2020-10-23T09:04:52.9718588Z Get-AzADUser

What should i do so that it returns the ADUser objects?

Answer 1

In Azure Cloud Shell, it uses the credential of the user logged in the azure portal, if it works, it just means your user account has the permission to list the users.

In the devops pipeline, it uses the credential of the service principal which is configured in the Project Settings -> Service connections , not the user account logged in the devops.

To solve the issue, navigate to the Project Settings in devops -> Service connections -> find the service connection you used -> click Manage Service Principal .

Then it will open the Azure AD App page of the service principal, navigate to the API permissions -> add the Application permission Directory.Read.All of Azure Active Directory Graph like below( Note : It should be Azure Active Directory Graph , not Microsoft Graph ).

Note: Don' forget to click the Grant admin consent for xxx button at last.

Then go to your devops to have a try, it should work.